General

  • Target

    0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3

  • Size

    686.6MB

  • Sample

    241110-n4fwtazjbk

  • MD5

    436c4290282bda086d3a38ae2ea5c2f5

  • SHA1

    c69e9b7ba4967be00330053ba6b152f8393da612

  • SHA256

    0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3

  • SHA512

    ca1efea143c0e73b9c50afeaf0826da24373990c93b176f84e2576596b5296a38765db6710becab1c1829a5a1dba84eb34504f79ae0d55964a845e66a0aab15b

  • SSDEEP

    98304:ULX0zHX9KZlxm8pNeRNO+eL1nZ779wnqRJh3kMDpzzY8:qXsHX9KmDJeLj9i4nda8

Malware Config

Targets

    • Target

      0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3

    • Size

      686.6MB

    • MD5

      436c4290282bda086d3a38ae2ea5c2f5

    • SHA1

      c69e9b7ba4967be00330053ba6b152f8393da612

    • SHA256

      0fd1f535929f90d75a59c57a8b33e4fb40381bb7ee31b3c18c10cb7c8d6599a3

    • SHA512

      ca1efea143c0e73b9c50afeaf0826da24373990c93b176f84e2576596b5296a38765db6710becab1c1829a5a1dba84eb34504f79ae0d55964a845e66a0aab15b

    • SSDEEP

      98304:ULX0zHX9KZlxm8pNeRNO+eL1nZ779wnqRJh3kMDpzzY8:qXsHX9KmDJeLj9i4nda8

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    • Privateloader family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

    • Checks whether UAC is enabled

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks